CVE-2026-88871 WWBN AVideo CustomizeUser setSubscribers CSRF via GET

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 contains a cross-site request forgery vulnerability in the CustomizeUser plugin's plugin/CustomizeUser/setSubscribers.json.php endpoint. The script reads usersid and ExtraSubscribers from $REQUEST and calls...

EUVD-2026-75421

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 master, 2026-08-23 contains a cross-site request forgery vulnerability in the CustomizeUser plugin's plugin/CustomizeUser/setSubscribers.json.php endpoint. The script reads usersid and ExtraSubscribers from $REQUEST and calls...

EUVD-2023-43667

Malicious code in bioql PyPI...

CVE-2023-39974

Exposure of Sensitive Information vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized actors to get the number of subscribers in a specific list...

CVE-2023-39974: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information vulnerability in AcyMailing Enterprise component for Joomla. It allows unauthorized actors to get the number of subscribers in a specific list...

Tour de Peloton: Exposed user data

An unauthenticated user could view sensitive information for all users, and snoop on live class statistics and its attendees, despite having a private mode. TL;DR Information disclosed included: - User IDs - Instructor IDs - Group Membership - Location - Workout stats - Gender and age - If they a...

Realtime Subscriber Count - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Realtime Subscriber Count published at the 'play' market has multiple vulnerabilities...